• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 127
  • Last Modified:

copy url from application pages

I have an application that people need to log into.  If you log in and then go to the address bar - you copy the url - close the browser (this ends the session) Open IE and then paste the copied url into the address bar - you get right into the application - no login screen!  Anyone know why the application.cfm is not controlling this?
Thanks!
0
ahillman
Asked:
ahillman
1 Solution
 
smaglio81Commented:
I am not sure. These types of things sometimes have a variety of causes. I think it might help narrow down the possibilities if we had a better idead of what was going on in Application.cfm. What kind of verification algorithm are you using. Did you write your own session management code, or are you using <cflogin>/<cflogout>?

Steven
0
 
reitzenCommented:
We store the session info in the client scope and the session scope and compare each call via the application.cfm.  If the two values don't match, we assume the user has closed their browser and need to login again.

application.cfm
<cfif Client.browserSession NEQ session.SessionID>
  <cflocation url="login.cfm">
</cfif>

Once the user has been authenticated in the login.cfm
<cfif IsDefined("cookie.jsessionid")>
  <cfset Client.browserSession = cookie.jsessionid>
</cfif>

HTH
0
 
Tacobell777Commented:
yes, because the user did not log out, i.e. the variables still exist
closing the browser does not end the session, the session variables still exist in memory on the server - users accesses the application again and the cookie still exists on the users machine, so its just like they never been gone.

You can set cookies to expire when the browser closes, and when they access the application again it should not let them in, however the session variables still exists in memory on the server if they have not explicitly been destroyed (ofcourse they will time out after the period defined in the application tag)..
0
 
ahillmanAuthor Commented:
Makes lots of sense - I was under the impression that the session is killed when the browser is closed - wrong assumption obviously.  So - lets say i decided to bookmark or save a url that would take me directly into the application at a later date.  This wouldn't work after the session has ended on my server correct?  Good to know.  If I wanted to have the session end when the browser is closed and have the cookie go away at the same time - what would be the proper coding? This isn't a security risk for this particular application but could be for another one that is in the works.
Thanks!
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now